SOC & Response

Script & Automation Engine

PowerShell, Bash, Python — push to fleet, track results

What it does

AlertMonitor's script engine lets you push PowerShell, Bash, or Python scripts to your entire endpoint fleet instantly — or to targeted groups. Self-healing automation, scheduled maintenance tasks, and bulk configuration operations all run through a single interface with full output logging and exit code tracking. Every script run is auditable: who initiated it, when, to which endpoints, and what the result was.

Automation is the force multiplier: A self-healing script that restarts a crashed service before a ticket is filed, a daily cleanup that prevents disk-full outages, a compliance check that runs itself every Friday morning — automation compounds. Each script written is analyst time permanently recovered.

Capabilities

  • Fleet-wide script push with group targeting: run against all endpoints, a site, or a custom group
  • PowerShell, Bash, and Python support — scripts run under configurable execution contexts
  • Output capture: stdout, stderr, and exit codes stored and searchable per execution
  • Scheduled scripts: recurring maintenance tasks with configurable cron-style scheduling
  • Self-healing automation: scripts triggered by alert conditions — restart a service, clear disk space, kill a process
  • Script library: pre-built maintenance scripts for common Windows and Linux tasks
  • Audit log: every execution recorded with initiator identity, timestamp, and target list

How it works

Scripts run through the AlertMonitor RMM agent as a child process under the configured execution user. PowerShell execution policy is set per-script via a wrapper that respects the configured policy. Script content is stored encrypted at rest and transmitted to the agent over the encrypted agent channel — scripts never touch disk in plaintext outside the execution environment. Result storage is per-execution with 90-day retention by default.